[Diy_efi] if YOU were bored enough to disassemble...

[Dave Gallant, 12 Point Racing]

hello all - 

I am brainstorming on my next plan of attack on working through JUST what is
going on inside my motorcycle ECU, and thought I would ask for opinions as I
have as much EE in me as a lumberjack. My end goal is to be able to flow
chart the entire code base within an EPROM on my particular ECU/EFI
hardware, thus being able to edit it once complete. I am sure most of you
have heard this before...

I will start with the hardware. The ECU is a Weber 1.6M ECU using a Motorola
68HC11 processor, with a 27C512 EPROM socketed on. I am told older Fords
(possibly cosworths?) used this very ECU to drive their applications, so
possibly someone has dealt with this ECU in the past. Things of interest in
the EPROM code are the fact that almost all BIN files I have collected share
the "3 part" design, with a base level code chunk, a separate code chunk for
the specific maps and calibrations, and a small starting code block that
dictates the memory starting point and I believe external hardware links.

In my particular case, I believe I have successfully determined where my
primary and secondary fuel maps are, and possibly one of the timing tables.
In these cases, I knew what I was supposed to be looking for, and the 16x16
tables are sticking out like sore thumbs. Unfortunately, I am slightly stuck
on a plausible route to continue working through this code.

I have a completely disassembled (and thought correct) code base at this
point (showing correct motorola opcodes no less), however without a good
idea of the hardware schematic (or any real grasp on the Motorola assembly
language programming) this direction is proving daunting.

I could also build up a "running" mock up of my motor on my work bench by
creating the trigger attached to an electric motor and running it at various
sustained RPMs/TPS readings. I could hook up the entire working electrical
system to each specific sensor and measure certain things like
timing/injector pulse width before and after making code changes - thus
doing a brute force attack at reverse engineering the code base. The outcome
would be 90% of what is desired, however, I would still not know exactly
where the calibration constants lived without complete "shots in the dark".

Anyone have any suggestions on how to continue?? Doing both seems the only
real way to accomplish my goal (goal: generate a flow chart from beginning
to end of entire code base, as to later be able to edit code to suit new
motor characteristics - and using the motor on the bench to determine if my
code is indeed behaving as planned). However - I am finding limited
resources on actually learning Motorola based (not intel) assembly, and even
then, without hardware schematics, am not sure how to know "this variable is
the temp sensor reading coming in divided by 2".

I enjoy tinkering with this, and have been playing around in this code for
nearly 6 months on and off - so there is little fear of being discouraged
and giving up. I am really just looking for direction/advice if YOU were to
attempt such a silly thing as I am doing.

Thoughts anyone? Bueller? :)

-dave

(BTW: all others interested in Motorcycle EFI may find this project of
interest as this is off a Ducati 748. What may be of interest is the fact
that this system has the capability to drive 4 injectors and 4 plugs - thus
making it an easy swap onto an inline 4 engine IF the code base can be
"discovered". The parts might prove slightly more expensive than salvaged
parts off cars, however the throttle bodies would work for those who can not
CNC their own from scratch)

----------------------
dave at 12pointracing.com
www.12pointracing.com
MRA #31, AMA #232




_______________________________________________
Diy_efi mailing list
Diy_efi at diy-efi.org
http://www.diy-efi.org/mailman/listinfo/diy_efi